Post-incident review or after-action report: which one do you owe, and to whom?
A post-incident review is a meeting. An after-action report is a document. They are not two competing formats, and treating them as alternatives is how an organization can end up having the conversation and keeping nothing. You owe the review to yourself. You owe the report to whoever is going to ask, later, what happened and what you did about it.
What is the actual difference?
The review is the process of working out what happened. NIST describes it as the point where Improvements are often identified when creating follow-up reports for incidents or holding “lessons learned” meetings when an incident’s recovery efforts are concluding (NIST Special Publication 800-61r3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, 2025).
The report is what the process leaves behind. The same guidance says to Prepare an after-action report that documents the incident itself, the response and recovery actions taken, and lessons learned (NIST Special Publication 800-61r3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, 2025).
Part of the confusion comes from two traditions using the words differently. In engineering the name can go to the write-up: Google’s site reliability guidance defines a postmortem as a written record of an incident, with review sessions held to go over it (Google, Site Reliability Engineering, chapter 15, Postmortem Culture: Learning from Failure, 2017). In emergency management the report is the deliverable and federal exercise doctrine pairs it with an improvement plan, describing evaluation as documenting strengths, areas for improvement, capability performance, and corrective actions in an After-Action Report (AAR)/Improvement Plan (IP) (FEMA, Homeland Security Exercise and Evaluation Program doctrine, 2020).
Both are right. They are describing different halves of the same thing.
Which one do you owe, and to whom?
| Post-incident review | After-action report | |
|---|---|---|
| What it is | A meeting | A dated document |
| Who runs it | Whoever ran the response | Whoever recorded it, ideally not the same person |
| Audience | The people who were there, and their teams | Your carrier, your auditor, a regulator, your board |
| Optimised for | Honesty | Being read by somebody who was not there |
| Fails when | Nobody writes it down | It is written so carefully it says nothing |
| Do you owe it | To yourself, always | Whenever an outside reader will ask |
The row that matters is the audience. A review optimised for honesty and a report optimised for an outside reader want different things from the same conversation, which is why running the review and then writing the report is easier than trying to do both at once.
Does an exercise produce one, the other, or both?
Both, and this is where the two traditions finally agree. An exercise ends with a discussion, and the discussion produces a document. What separates a useful document from a filed one is whether the findings carry owners and dates.
FEMA’s summary of federal exercise doctrine says SMART ensures that corrective actions are developed to be Specific, Measurable, Achievable, Relevant, and Time-bound (FEMA, Homeland Security Exercise and Evaluation Program (HSEEP) 2020 Revision information sheet, 2020), and CISA’s public tabletop template gives each finding a corrective action, a responsible organization, a point of contact, a start date and a completion date (CISA, Tabletop Exercise Package After-Action Report / Improvement Plan template, 2020).
That five-field shape is the whole difference between a report and a list of complaints. Adopt it whether the trigger was a real incident or an exercise.
When does the name matter?
Only when somebody outside reads it.
Internally, call it whatever your organization already calls it. Externally, the document to hand a carrier, an auditor or a customer is a dated report naming the scenario or incident, the people involved by role, the decisions taken, and findings with owners against them. Give them that and the label on the front page is the least important thing about it.
Is a post-mortem the same as a post-incident review?
Yes, in practice. Post-mortem, post-incident review and retrospective are the same review under three names. The after-action report is the artifact, not the meeting, which is why it is not a fourth name for the same thing.
Do we need both after a real incident?
You need the review, and you need something written down at the end of it. Whether the written thing is called an after-action report matters only when somebody outside the organization is going to read it, at which point the name and the structure both start to matter.
Does a blameless post-mortem still work as evidence?
Yes, and the blameless framing is compatible with what an outside reader needs. Give a carrier or an auditor roles, decisions, findings and owners. None of that requires naming an individual as at fault, and our own reports do not.